read permissions on every GET

shopdb/core/api/dashboarddefaults.py

@@ -13,6 +13,7 @@ from shopdb.core.models.dashboarddefault import (
     DISPLAY_ROLES, DISPLAY_ROLE_PATHS, normalize_display_role)
 from shopdb.utils.responses import success_response, error_response, ErrorCodes
 from shopdb.utils.authz import require_role
+from shopdb.utils.authz import require_permission
 
 dashboarddefaults_bp = Blueprint('dashboarddefaults', __name__)
 
@@ -102,7 +103,7 @@ def display_role():
 
 
 @dashboarddefaults_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('settings.view')
 def list_defaults():
     """List all visitor-IP -> business-unit mappings."""
     defaults = DashboardDefault.query.filter_by(isactive=True).order_by(